Vulnerability Assessment and Penetration Testing Training

About This Course

In an era of escalating cyber threats, organisations can no longer rely solely on reactive security measures. Vulnerability assessment and penetration testing (VAPT) have become essential disciplines that enable organisations to proactively identify weaknesses before malicious actors can exploit them. From financial institutions and healthcare providers to government agencies and technology firms, every sector depends on professionals who can simulate real-world attacks, evaluate security controls, and deliver actionable intelligence.

This ten-day TrainingComplex programme provides a rigorous, hands-on exploration of the complete penetration testing lifecycle — from scoping and reconnaissance through exploitation, post-exploitation, and professional reporting. Participants work with industry-standard tools including Nmap, Metasploit, Burp Suite, Nessus, Wireshark, and more, applying them in structured lab environments that mirror actual enterprise architectures.

The course follows internationally recognised frameworks including OWASP, PTES (Penetration Testing Execution Standard), and NIST SP 800-115, ensuring that skills acquired are directly transferable to professional engagements and aligned with certification pathways such as CEH, OSCP, and CompTIA PenTest+. Participants will leave with a deep understanding of attacker mindset, a practical toolkit, and the confidence to design, conduct, and communicate penetration testing engagements within their organisations or as external consultants.

Who Should Attend

IT Security Analysts and Engineers seeking to formalise their offensive security skills
Network and Systems Administrators responsible for hardening organisational infrastructure
Cybersecurity Consultants and Ethical Hackers entering professional VAPT engagements
SOC Analysts looking to understand attacker techniques to improve detection and response
IT Managers and Risk Officers overseeing vulnerability management programmes
Digital Forensics Professionals expanding into proactive security testing
Government and Critical Infrastructure Security Personnel
Recent Computer Science or Information Security graduates entering the cybersecurity field

Learning Objectives

Understand the legal, ethical, and contractual foundations of professional penetration testing engagements
Apply structured penetration testing methodologies including PTES, OWASP, and NIST SP 800-115
Conduct comprehensive passive and active reconnaissance using open-source intelligence (OSINT) techniques and tools
Perform network scanning, enumeration, and service fingerprinting using Nmap and related utilities
Identify and validate vulnerabilities in operating systems, network services, and web applications using automated and manual techniques
Exploit common vulnerabilities in Windows and Linux environments using Metasploit and manual exploitation techniques
Assess web application security against the OWASP Top 10, including injection flaws, authentication weaknesses, and access control issues
Conduct wireless network security assessments and identify common Wi-Fi attack vectors
Perform post-exploitation activities including privilege escalation, lateral movement, and persistence mechanisms
Evaluate Active Directory environments for common misconfigurations and attack paths
Understand and apply social engineering concepts in the context of a penetration test
Document findings professionally and produce client-ready penetration testing reports with risk ratings and remediation guidance
Develop a structured vulnerability management and remediation tracking framework for ongoing organisational use

Course Modules

Module 1: Foundations of Ethical Hacking and Penetration Testing

The legal and ethical landscape: authorisation, rules of engagement, and liability
International frameworks and standards: PTES, OWASP Testing Guide, NIST SP 800-115
Types of penetration testing: black box, white box, grey box, and red team operations
Setting up the penetration testing lab environment: Kali Linux, virtualisation, and target machines
The penetration testing lifecycle: phases from pre-engagement through to reporting and remediation validation
Scoping a penetration test engagement: defining targets, exclusions, timelines, and emergency contact procedures

Module 2: Reconnaissance and Open-Source Intelligence (OSINT)

Passive reconnaissance techniques: WHOIS, DNS enumeration, and certificate transparency logs
OSINT tools and platforms: Maltego, Shodan, theHarvester, and Google dorking
Active reconnaissance concepts and distinguishing passive from active information gathering
Mapping the attack surface: identifying domains, IP ranges, technologies, and personnel
Social media and metadata intelligence: extracting organisational and personnel data from LinkedIn, job postings, and document metadata
Recon-ng framework: automating OSINT collection through modules, workspaces, and structured reporting

Module 3: Network Scanning and Enumeration

Host discovery and port scanning with Nmap: techniques, timing, and stealth options
Service version detection, OS fingerprinting, and NSE scripting
Enumeration of common services: SMB, FTP, SSH, RDP, SNMP, and LDAP
Building a target network map and prioritising attack vectors from enumeration data
Firewall and IDS evasion during scanning: fragmentation, decoy scanning, and source port manipulation
Using Netcat and Masscan as complementary tools for rapid banner grabbing and large-scale port discovery

Module 4: Vulnerability Identification and Analysis

Vulnerability scanning with Nessus and OpenVAS: configuration, execution, and result interpretation
Differentiating vulnerability scanning from penetration testing and managing false positives
CVSS scoring, CVE databases, and risk prioritisation frameworks
Manual vulnerability verification: confirming scanner findings without causing service disruption
Researching vulnerabilities using NVD, Exploit-DB, and vendor advisories to assess exploitability and patch availability
Contextualising vulnerabilities within the target environment: chaining low-severity findings to identify compounded business risk

Module 5: Exploitation Fundamentals and Metasploit Framework

Understanding the exploitation process: payloads, encoders, listeners, and sessions
Navigating and using the Metasploit Framework: modules, workspaces, and post modules
Exploiting common vulnerabilities in Windows and Linux systems in a lab environment
Meterpreter fundamentals: session management, file operations, and pivoting basics
Manual exploitation concepts: adapting public proof-of-concept exploit code and understanding shellcode execution without relying solely on Metasploit
Avoiding and bypassing common defensive controls during exploitation: antivirus evasion, payload obfuscation, and staged versus stageless payload selection

Module 6: Web Application Penetration Testing

OWASP Top 10 deep dive: injection, broken authentication, IDOR, security misconfiguration, and more
Web application reconnaissance: spidering, directory brute-forcing, and technology fingerprinting with Burp Suite
Manual testing for SQL injection, Cross-Site Scripting (XSS), and Cross-Site Request Forgery (CSRF)
API security testing: REST API enumeration, authentication bypass, and data exposure vulnerabilities
Server-Side Request Forgery (SSRF) and XML External Entity (XXE) injection: identification, exploitation, and impact assessment
Burp Suite Pro advanced features: active scanner tuning, Intruder payload strategies, and using Collaborator for out-of-band vulnerability detection

Module 7: Active Directory and Windows Environment Attacks

Active Directory architecture: domains, trusts, Kerberos authentication, and group policies
Common AD attack techniques: Pass-the-Hash, Pass-the-Ticket, Kerberoasting, and AS-REP Roasting
Privilege escalation in Windows environments: misconfigured services, token impersonation, and unquoted paths
Lateral movement techniques and BloodHound-based attack path analysis
DCSync and credential extraction using Mimikatz: dumping NTLM hashes, Kerberos tickets, and cleartext credentials from memory
Abusing Group Policy Objects and Active Directory Certificate Services (AD CS) misconfigurations to achieve privilege escalation and persistence

Module 8: Linux Privilege Escalation and Post-Exploitation

Linux privilege escalation vectors: SUID binaries, cron jobs, writable paths, and sudo misconfigurations
Post-exploitation objectives: situational awareness, credential harvesting, and data exfiltration techniques
Persistence mechanisms: backdoors, scheduled tasks, and SSH key injection
Covering tracks: log manipulation concepts, artefact awareness, and forensic footprint considerations
Using LinPEAS and Linux Exploit Suggester to automate enumeration and identify kernel-level and application-level escalation opportunities
Network pivoting from a compromised Linux host: SSH tunnelling, dynamic SOCKS proxies, and Chisel for reaching segmented internal networks

Module 9: Wireless Network Security Assessment

Wireless security protocols: WEP, WPA2, WPA3, and common implementation weaknesses
Wireless reconnaissance and network discovery using Aircrack-ng and Kismet
Attacking WPA2 networks: handshake capture, dictionary attacks, and PMKID attacks
Rogue access points, evil twin attacks, and client-side wireless attack concepts
Wireless adapter selection and monitor mode configuration: understanding hardware requirements, chipset compatibility, and packet injection capabilities
Assessing enterprise wireless environments: EAP method weaknesses, RADIUS misconfigurations, and credential capture using hostapd-wpe

Module 10: Social Engineering in Penetration Testing

Social engineering as an attack vector: phishing, vishing, smishing, and pretexting
Designing a phishing simulation campaign using GoPhish and email spoofing techniques
Physical security testing concepts: tailgating, badge cloning awareness, and on-site pretexting
Measuring and reporting social engineering outcomes within the scope of a formal engagement
Psychological principles underpinning social engineering: authority, urgency, reciprocity, and scarcity as manipulation levers
Developing realistic pretexting scenarios and spear-phishing lure content tailored to the target organisation's context, industry, and personnel

Module 11: Reporting, Documentation, and Client Communication

Structure of a professional penetration testing report: executive summary, technical findings, and appendices
Risk rating frameworks: CVSS, DREAD, and qualitative business impact assessment
Writing clear, reproducible finding narratives with evidence, proof-of-concept steps, and remediation guidance
Presenting findings to technical and non-technical stakeholders: translating risk into business language
Handling sensitive data in report deliverables: redaction practices, secure transmission, and retention and destruction obligations
Remediaton recommendation quality: providing specific, actionable, and prioritised fix guidance rather than generic best-practice references

Module 12: Vulnerability Management and Remediation Frameworks

Building an organisational vulnerability management programme: discovery, prioritisation, remediation, and verification
Remediation tracking tools and integrating VAPT findings into ticketing and GRC platforms
Re-testing and validation: confirming fixes without conducting a full repeat engagement
Metrics, KPIs, and reporting cadence for continuous vulnerability management
Risk acceptance and exception management: documenting, approving, and periodically reviewing vulnerabilities that cannot be immediately remediated
Aligning the vulnerability management programme with regulatory and compliance requirements: ISO 27001, Cyber Essentials, PCI DSS, and DORA obligations

Module 13: Capstone Penetration Test and Professional Debrief

End-to-end simulated engagement: scoping, reconnaissance, exploitation, post-exploitation, and reporting against a target organisation environment
Time-managed CTF and structured attack scenario requiring documentation of all findings
Peer and facilitator review of submitted penetration testing reports with detailed written and verbal feedback
Career pathways, certification roadmap (CEH, OSCP, CompTIA PenTest+), and continuing professional development in cybersecurity
Defensive perspective debrief: reviewing how the simulated engagement would appear from a blue team and SOC monitoring standpoint to reinforce detection awareness
Personal skills gap analysis and individualised study plan: identifying technical areas for further development and mapping them to practical labs, platforms, and certification preparation resources

Requirements & Prerequisites

Participants should have a solid working knowledge of TCP/IP networking, operating system fundamentals (Windows and Linux), and basic IT security concepts. Familiarity with the command line in both Windows and Linux environments is essential, as the course involves significant hands-on tool usage from day one. Prior exposure to networking protocols, firewalls, or basic security concepts through study or professional experience is recommended, though formal security certifications are not required to attend.

Training Methodology

Guided hands-on lab sessions in a purpose-built virtual environment replicating enterprise network architectures, allowing safe and legal exploitation practice
Step-by-step tool walkthroughs covering Nmap, Metasploit, Burp Suite, Nessus, Wireshark, John the Ripper, and Aircrack-ng with real target systems
Capture-the-Flag (CTF) style challenges at the end of each major topic to reinforce skill acquisition through problem-solving under realistic constraints
Case study analysis of real-world data breaches and penetration testing engagements, dissecting attacker techniques and organisational response
Peer-reviewed report writing exercises where participants draft, critique, and refine professional penetration testing reports
Group red team versus blue team simulation exercises encouraging collaborative attack planning and defensive analysis
Structured debriefs after each major lab to consolidate learning, address misconceptions, and link practical findings to theoretical frameworks
Final capstone assessment: a full end-to-end penetration test against a simulated target organisation, culminating in a formal written report and verbal debrief presentation

Organisational Benefits

Organisations gain trained professionals capable of conducting in-house vulnerability assessments, reducing reliance on costly external consultancies
Improved identification and remediation of security weaknesses before they are exploited by malicious actors
Stronger alignment with cybersecurity frameworks and regulatory requirements including ISO 27001, PCI DSS, and GDPR
Enhanced security posture through proactive, evidence-based testing rather than reactive incident response
Development of internal red team capabilities that continuously challenge and improve defensive controls
Better quality penetration testing procurement decisions and more effective oversight of external security vendors
Clear, professional reporting practices that translate technical findings into business risk language for executive stakeholders
A culture of security awareness and proactive risk management embedded within the IT function

Where Is Vulnerability Assessment and Penetration Testing Training Offered?

This course runs in-person across: Cape Town, Lagos, Mombasa, Arusha, Johannesburg, Accra, Naivasha, Dar es Salaam, Nakuru, Kisumu, Addis Ababa, Kampala, Kigali, Nairobi, Dubai, Pretoria, Riyadh, Abuja, Zanzibar, plus Live Virtual (online) cohorts. Browse live dates for your city below.

Upcoming Schedules

Location	Format	Dates	Price
Cape Town, South Africa	In-Person	28 Sept 2026 – 9 Oct 2026	USD 7,600
Lagos, Nigeria	In-Person	5 Oct 2026 – 16 Oct 2026	USD 5,000
Mombasa, Kenya	In-Person	5 Oct 2026 – 16 Oct 2026	KES 230,000
Arusha, Tanzania	In-Person	12 Oct 2026 – 23 Oct 2026	USD 4,200
Johannesburg, South Africa	In-Person	19 Oct 2026 – 28 Oct 2026	USD 7,000
Accra, Ghana	In-Person	19 Oct 2026 – 28 Oct 2026	USD 7,600
Naivasha, Kenya	In-Person	19 Oct 2026 – 28 Oct 2026	KES 240,000
Dar es Salaam, Tanzania	In-Person	19 Oct 2026 – 28 Oct 2026	USD 4,600
Live Virtual	Online	19 Oct 2026 – 28 Oct 2026	KES 160,000
Nakuru, Kenya	In-Person	19 Oct 2026 – 30 Oct 2026	KES 230,000
Kisumu, Kenya	In-Person	19 Oct 2026 – 28 Oct 2026	KES 240,000
Addis Ababa, Ethiopia	In-Person	19 Oct 2026 – 30 Oct 2026	USD 4,800
Kampala, Uganda	In-Person	19 Oct 2026 – 28 Oct 2026	USD 3,800
Live Virtual	Online	24 Oct 2026 – 13 Dec 2026	KES 160,000
Kigali, Rwanda	In-Person	26 Oct 2026 – 4 Nov 2026	USD 3,800

+238 more dates — view live schedule →

Frequently Asked Questions

Do I need prior cybersecurity certifications to attend this course?

No formal certifications are required. However, participants should have a working knowledge of TCP/IP networking, Windows and Linux operating systems, and basic IT security concepts. Professionals with hands-on IT experience will be best positioned to benefit from the programme.

Will I be using real hacking tools during the course?

Yes. The course involves extensive hands-on use of industry-standard tools including Nmap, Metasploit, Burp Suite, Nessus, Wireshark, Aircrack-ng, and BloodHound, all used within a controlled, legal virtual lab environment. No live production systems are targeted at any point.

Does this course prepare me for any industry certifications?

The curriculum is closely aligned with the knowledge domains of certifications including CEH (Certified Ethical Hacker), CompTIA PenTest+, and the foundational concepts tested in the OSCP. While the course does not issue these certifications directly, it provides substantial preparation for each.

What will I receive upon completing the course?

Participants who complete the programme receive a TrainingComplex Certificate of Completion in Vulnerability Assessment and Penetration Testing. This certificate documents the competencies covered and hours of training, suitable for inclusion in professional portfolios and CPD records.

Is this course available online for participants who cannot travel?

Yes. The programme is offered as a Live Virtual option through scheduled cohorts, delivering the full curriculum including interactive labs via a cloud-hosted virtual environment. Participants receive the same hands-on lab access and facilitator engagement as in-person attendees.

View Live Schedule & Book →